v0.42.3

Release Notes

Latest Release: v0.42.3 (July 25, 2026)

Secure Compatibility and Workspai Migration

This patch keeps the legacy rapidkit npm compatibility package safe and makes
the migration path to Workspai shorter and clearer. Runtime command behavior is
unchanged.

Security:

• Updated brace-expansion to 5.0.8 to resolve the current high-severity
  unbounded-expansion denial-of-service advisory.
• Updated postcss to 8.5.23 to resolve the current high-severity previous
  source-map path traversal advisory.
• Updated the compatible transitive nanoid dependency selected by PostCSS.
• npm audit --audit-level=high reports zero vulnerabilities.

Migration and documentation:

• Replaced the feature-heavy README with a concise compatibility and migration
  entry point.
• Added a source-preserving migration guide for existing projects, named
  workspaces, CI, agent/IDE consumers, verification, and rollback.
• Added migration notices to user-facing legacy documentation so direct links
  do not look like new-project onboarding.
• Strengthened the docs drift and npm publish contracts around the legacy
  package boundary.

Breaking changes: None.

Verification:

• npm audit --audit-level=high
• npm run check:brand
• npm run validate:docs
• npm test
• npm run build

Upgrade:

npm install -g rapidkit@0.42.3

New projects should install and use workspai instead.

Full Release Notes

v0.42.2

Release Notes

Latest Release: v0.42.2 (July 22, 2026)

Dependency Security Maintenance

This patch keeps the legacy compatibility CLI behavior unchanged while
refreshing its dependency lockfile against current npm security advisories.

Fixed:

• High-severity brace-expansion denial-of-service advisory.
• High-severity fast-uri host-confusion advisories.
• High-severity js-yaml quadratic CPU-consumption advisory.

Breaking changes: None.

Verification:

• npm audit --audit-level=high
• npm run validate
• npm run build

Upgrade:

npm install -g rapidkit@0.42.2

Full Release Notes

v0.42.1

Release Notes

Latest Release: v0.42.1 (July 9, 2026)

Workspai Migration Notice

This patch release keeps the legacy rapidkit npm package available while
making the migration path to Workspai explicit for new users.

What's New:

• README migration guidance

  • New installs are directed to the workspai npm package.
  • The new repository is linked at
    rapidkitlabs/workspai.
  • The legacy rapidkit package is documented as a compatibility package that
    is planned for deprecation in a future release.

• CLI help migration guidance

  • npx rapidkit --help now prints a migration notice before the legacy command
    reference so users who do not read the README still see the new path.

• Contract bridge alignment

  • Extension compatibility metadata points to workspai@0.43.1.
  • Runtime/create-planner wording uses Workspai for the npm CLI ownership
    surface.

Breaking changes: None.

Verification:

• npm run validate:contracts
• npm run build
• npm run test -- src/__tests__/index.test.ts
• node dist/index.js --help

Upgrade:

npm install -g rapidkit@0.42.1

Full Release Notes

v0.42.0

Release Notes

Latest Release: v0.42.0 (July 6, 2026)

Optional Python Engine and Profile Compatibility

This minor release separates Workspace Intelligence from the workspace-local
Python engine. Teams can now create governed workspaces first, model/adopt/import
projects, and install the local Python engine only when a RapidKit
module-enabled kit actually needs it.

What's New:

• Optional Python engine for Python-aware profiles

  • create workspace --skip-python-engine keeps python-only, polyglot, and
    enterprise workspaces available for Workspace Intelligence without
    installing rapidkit-core immediately.
  • Skipped workspaces record explicit python_core.status = skipped metadata
    in workspace manifests, markers, and toolchain evidence.
  • Local launchers now explain the skip state and point users to npm-owned
    workspace commands until the Python engine is intentionally installed.

• Python-free workspace integrity

  • minimal, java-only, node-only, go-only, and dotnet-only workspaces
    no longer create root-level pyproject.toml, poetry.toml,
    .python-version, or .venv artifacts.
  • Empty skipped workspaces and arbitrary adopted/imported Python projects keep
    the Python engine skipped unless a RapidKit module-enabled kit is present.

• Module-enabled kit gate

  • RapidKit module commands are guaranteed only for RapidKit-owned
    module-enabled kits: fastapi.standard, fastapi.ddd, and
    nestjs.standard.
  • Adopted/imported projects can still be modeled, governed, verified, and
    surfaced in Workspace Intelligence even when module mutation is disabled.

• Profile/runtime compatibility

  • create project, import, adopt, and bootstrap compliance now share a
    consistent profile compatibility policy.
  • Default mode warns and recommends profile realignment; strict mode blocks
    mismatched runtime additions before registration.
  • Broader language/runtime signals such as Rust, C, and C++ are counted in the
    workspace runtime mix even when RapidKit does not own a native scaffold.

Breaking changes: None.

Verification:

• npm exec -- vitest run src/__tests__/e2e.test.ts src/__tests__/create-internal.test.ts src/__tests__/workspace-python-engine-install-gate.test.ts
• npm run typecheck -- --pretty false
• npm run lint
• npm run build
• npm exec -- vitest run

Upgrade:

npm install -g rapidkit@0.42.0

Full Release Notes

v0.41.5

Release Notes

Latest Release: v0.41.5 (July 4, 2026)

Workspace Creation Location and Governance Gate Fixes

This patch release tightens workspace creation, Doctor workspace discovery, and
Workspace Verify exit-code behavior for Workspai, CI, and CLI users.

What's New:

• Workspace creation location integrity

  • create workspace now respects an explicitly selected target parent
    (Current directory, --here, or --output <parent-dir>) when checking
    duplicate workspace names.
  • A workspace with the same name in the managed home no longer blocks creating
    another workspace in a different explicit parent directory.
  • Creating into an already-existing target path is still blocked.

• Doctor empty workspace handling

  • doctor workspace no longer treats an empty workspace shell as a project
    just because the workspace root contains toolchain files such as
    pyproject.toml or poetry.toml.
  • Empty workspace shells now report zero discovered projects and a workspace
    discovery warning instead of misleading project health.

• Workspace Verify exit codes

  • Default-mode needs-attention verification now reports a passing gate with
    exit code 0.
  • Strict mode still fails non-ready verification as expected.

Breaking changes: None.

Verification:

• npm exec -- vitest run src/__tests__/workspace-create-location.test.ts
• npm run typecheck -- --pretty false
• npm run build

Upgrade:

npm install -g rapidkit@0.41.5

Full Release Notes

v0.41.4

Release Notes

Latest Release: v0.41.4 (July 2, 2026)

Cross-Artifact Studio Remediation Plan

This patch release adds a workspace-level repair contract for Workspai Studio and
agent consumers. Instead of scraping individual governance cards, npm can now emit
one ordered remediation plan across Bootstrap, Doctor, Analyze, Readiness, Pipeline,
Workspace Run, and Workspace Verify evidence.

What's New:

• workspace remediation-plan

  • New command: rapidkit workspace remediation-plan [--json] [--write] [--ci] [--include-paths]
  • Scans .rapidkit/reports/ and builds a Studio-ready action list with risk,
    approval state, verify commands, and deterministic file operations where safe.
  • --ci produces stricter verify-oriented command plans where supported.

• artifact-remediation-plan.v1

  • New schema at contracts/artifact-remediation-plan.v1.json
  • Persists to .rapidkit/reports/artifact-remediation-plan-last-run.json
  • Bridges Doctor-specific plans with cross-card governance repair for dashboard
    and Studio handoff consumers.

• Published contract surface

  • Added to runtime-command-surface.v1, extension-cli-compatibility.v1,
    agent-customization-pack.v1, workspace model evidence refs, and agent-sync
    catalog entries.
  • Operational skills now direct agents to read the artifact remediation plan
    before per-card improvisation.

Breaking changes: None.

Verification:

• npm run typecheck
• npm run validate:contracts
• npm test
• npm run smoke:enterprise-package
• npm run prepack

Upgrade:

npm install -g rapidkit@0.41.4

Full Release Notes

v0.41.3

Release Notes

Latest Release: v0.41.3 (July 2, 2026)

Enterprise Doctor Evidence and Studio Remediation Contracts

This patch release hardens RapidKit's npm source-of-truth layer for Workspai
Studio, enterprise workspace governance, and agent-facing evidence. Doctor now
emits deeper multi-language, multi-framework project signals; repair planning is
structured as an ordered remediation contract; and Workspace Intelligence
artifacts carry fact-level freshness metadata so humans and agents know which
facts are durable, derived, evidence-backed, live, or verification-gated.

What's New:

• Enterprise Doctor evidence

  • doctor workspace, doctor workspace --fix, doctor project, and
    doctor project --fix now inspect broader project surfaces: dependency
    contracts, env/config baselines, tests, quality tooling, security tooling,
    container/deployment files, migrations, health probes, and runtime
    entrypoints.
  • Doctor output is more reliable across frontend, backend, and polyglot
    workspaces, with canary coverage for multi-stack scenarios.

• Studio-ready remediation

  • New doctor-remediation-plan.v1 contract describes ordered safe and guarded
    repair steps, file hints, verification commands, rollback metadata, and
    repair capability state.
  • Doctor repair capabilities now favor the smallest safe edit first while
    keeping higher-risk steps review-gated for Workspai Studio.

• Fact freshness

  • New fact-freshness.v1 contract extends freshness from artifact-level
    metadata down to the facts that agents actually reason over.
  • Workspace context, model, history, verify, and agent-sync outputs now expose
    the newer freshness and remediation evidence in structured form.

• Enterprise CLI gates

  • CLI routing and release gates are hardened around npm-vs-Python RapidKit
    command ownership, package smoke, manual release workflows, and Studio-safe
    repair command execution.

Breaking changes: None.

Verification:

• npm run typecheck
• npm run validate:contracts
• npm test
• npm run smoke:enterprise-package
• npm run prepack

Upgrade:

npm install -g rapidkit@0.41.3

Full Release Notes

v0.41.2

Release Notes

Latest Release: v0.41.2 (June 28, 2026)

Workspace Intelligence Contract and Publish Smoke Hardening

This patch release tightens the npm source-of-truth layer for Workspai,
enterprise CI, and agent-facing workspace operations. It expands the published
Workspace Intelligence command surface, adds structured incident handoff
metadata for Studio consumers, hardens package smoke against noisy npm output
and read-only npm caches, and clarifies RapidKit's category positioning in the
README.

What's New:

• Workspace Intelligence command surface

  • runtime-command-surface.v1 now advertises workspace why and
    workspace trace as Workspace Intelligence subcommands alongside
    workspace explain.
  • Contract tests now assert explain, why, and trace stay published for
    IDE/CI capability detection.

• Studio incident handoff

  • studio-blocker-handoff.v1 now includes an additive incidentSummary
    object for phase, primary action, verification requirement, and audit state.

• Enterprise package smoke

  • enterprise-package-smoke now uses an isolated writable npm cache instead
    of inheriting a possibly read-only parent npm_config_cache.
  • The smoke parser now tolerates npm lifecycle noise before npm pack --json
    output.

• Workspace Intelligence docs and positioning

  • README positioning now leads with Open-Source Workspace Intelligence for
    Software Systems and clarifies that RapidKit is not another AI coding
    assistant, agent framework, or context engine.
  • The mental model now makes Workspace Intelligence framework-agnostic:
    RapidKit can govern created, imported, and adopted projects across frontend,
    backend, and polyglot stacks.
  • Contract docs now list the newer Workspace Intelligence schemas and fix the
    .rapidkit/AGENT-GROUNDING.md artifact path.

• Graph impact quality

  • Workspace impact centrality handling no longer relies on non-null
    assertions when building transitive impact and hotspot summaries.

Breaking changes: None.

Verification:

• npm run lint
• npm run typecheck
• npm run format:check
• npm run validate:docs
• npm run check:generated-contracts
• npm run check:shared-contracts
• npm test (1573 passed, 8 skipped)
• npm run smoke:enterprise-package
• npm run prepack

Upgrade:

npm install -g rapidkit@0.41.2

Full Release Notes

v0.41.1

Release Notes

Latest Release: v0.41.1 (June 28, 2026)

Enterprise Package Smoke and Runner Hardening

This patch release hardens the npm CLI for enterprise extension hosts, CI, and
publish gates: package runners no longer depend on a perfect PATH, piped CLI
output is safe before process exit, workspace-root init uses the same npm-aware
preflight as project lifecycle commands, and npm package smoke now blocks
publishing on broken artifacts.

What's New:

• Publish gates

  • prepack now builds dist, prepares packaged embeddings, verifies CLI command
    ownership, and runs enterprise package smoke before npm pack / publish.
  • CI and manual release workflows run smoke:enterprise-package.

• Package runner hardening

  • npm/npx/pnpm/yarn subprocesses resolve through a command-safe invocation
    contract (npm_execpath, well-known npm CLI paths, or corepack npm).
  • Nested npx --package environment pins are stripped before child package
    runners execute.
  • COREPACK_HOME is made writable for package-runner subprocesses.

• Pipe-safe CLI output

  • Piped stdout/stderr is written synchronously for CLI entrypoint execution so
    --version --json, workspace policy, cache, and lifecycle command output are
    not lost on fast exits.

• Workspace Intelligence graph

  • workspace-dependency-graph.v1 now carries richer operational profile,
    coverage, topology, and diagnostics data for Workspai enterprise graph
    surfaces.

• Scaffold/runtime stability

  • Frontend create commands and Node runtime package-manager detection use the
    same package-runner contract.
  • Workspace fleet init preflight accepts npm runners resolved outside PATH,
    matching project-level lifecycle execution.

Breaking changes: None.

Verification:

• ./node_modules/.bin/tsc --noEmit
• ./node_modules/.bin/vitest run (1573 passed, 8 skipped)
• node scripts/enterprise-package-smoke.mjs
• node scripts/prepack-enterprise.mjs

Upgrade:

npm install -g rapidkit@0.41.1

Full Release Notes

v0.41.0

Release Notes

Latest Release: v0.41.0 (June 23, 2026)

Phase 4 Workspace Intelligence Closure

This minor release completes the operational intelligence loop: human-readable
blocker narratives, agent feedback, MCP read bridge, operational skills, structured
doctor-fix evidence, and extended verify + fleet-run gates — all versioned for
Workspai, CI, and AI agents.

What's New:

• Explain / Why / Trace

  • workspace explain, workspace why, and workspace trace --from <diff> with
    workspace-explain.v1 artifact.

• MCP serve

  • Read-mostly stdio JSON-RPC: workspace mcp serve.

• Agent feedback & skills

  • workspace feedback record → history ring buffer.
  • Operational skills via workspace agent-sync --write (no separate generator).

• Doctor fix result

  • Structured fixResult on doctor workspace --fix --json
    (rapidkit-doctor-fix-result-v1).

• Verify & fleet extensions

  • Verify init/start fleet evidence + optional doctor-fix step.
  • Resolution hints on blocking steps.
  • workspace run custom stages, --reuse-passed, stage dependencies.

• Contracts

  • Nine new/updated Phase 4 schemas; extension CLI compatibility matrix expanded.

Breaking changes: None.

Upgrade:

npm install -g rapidkit@0.41.0

Full Release Notes